feat: prevent error when passed invalid uuid

controlplane/src/core/repositories/FeatureFlagRepository.ts

@@ -1,8 +1,9 @@
 import { Subgraph } from '@wundergraph/composition';
 import { joinLabel, splitLabel } from '@wundergraph/cosmo-shared';
-import { SQL, and, asc, count, eq, getTableName, inArray, like, or, sql } from 'drizzle-orm';
+import { SQL, and, asc, count, eq, inArray, like, or, sql } from 'drizzle-orm';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import { FastifyBaseLogger } from 'fastify';
+import { validate as isValidUuid } from 'uuid';
 import { parse } from 'graphql';
 import * as schema from '../../db/schema.js';
 import {
@@ -311,12 +312,8 @@ export class FeatureFlagRepository {
     }
 
     if (query) {
-      conditions.push(
-        or(
-          like(schema.targets.name, `%${query}%`),
-          sql.raw(`${getTableName(schema.subgraphs)}.${schema.subgraphs.id.name}::text like '%${query}%'`),
-        ),
-      );
+      const escapedQuery = query.replace(/‘/g, "''");
+      conditions.push(isValidUuid(query) ? eq(subgraphs.id, query) : like(schema.targets.name, `%${escapedQuery}%`));
     }
 
     if (!this.applyRbacConditionsToQuery(rbac, conditions)) {

controlplane/src/core/repositories/SubgraphRepository.ts

@@ -9,7 +9,8 @@ import {
 } from '@wundergraph/cosmo-connect/dist/platform/v1/platform_pb';
 import { joinLabel, normalizeURL, splitLabel } from '@wundergraph/cosmo-shared';
 import { addDays } from 'date-fns';
-import { and, asc, count, desc, eq, getTableName, gt, inArray, like, lt, notInArray, or, SQL, sql } from 'drizzle-orm';
+import { and, asc, count, desc, eq, gt, inArray, like, lt, notInArray, or, SQL, sql } from 'drizzle-orm';
+import { validate as isValidUuid } from 'uuid';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import { FastifyBaseLogger } from 'fastify';
 import { GraphQLSchema } from 'graphql';
@@ -697,11 +698,9 @@ export class SubgraphRepository {
     }
 
     if (opts.query) {
+      const escapedQuery = opts.query.replace(/‘/g, "''");
       conditions.push(
-        or(
-          like(schema.targets.name, `%${opts.query}%`),
-          sql.raw(`${getTableName(schema.subgraphs)}.${schema.subgraphs.id.name}::text like '%${opts.query}%'`),
-        ),
+        isValidUuid(opts.query) ? eq(schema.subgraphs.id, opts.query) : like(schema.targets.name, `%${escapedQuery}%`),
       );
     }
 
@@ -759,11 +758,9 @@ export class SubgraphRepository {
     }
 
     if (opts.query) {
+      const escapedQuery = opts.query.replace(/‘/g, "''");
       conditions.push(
-        or(
-          like(schema.targets.name, `%${opts.query}%`),
-          sql.raw(`${getTableName(schema.subgraphs)}.${schema.subgraphs.id.name}::text like '%${opts.query}%'`),
-        ),
+        isValidUuid(opts.query) ? eq(schema.subgraphs.id, opts.query) : like(schema.targets.name, `%${escapedQuery}%`),
       );
     }